Google has fixed a security flaw that exposed the email addresses of YouTube users,famous books about eroticism a potentially massive privacy breach.
Google — which owns YouTube — has confirmed that the vulnerabilities discovered by cybersecurity researchers, who go by Brutecat and Nathan, have been addressed, according to a report in BleepingComputer.
Aside from the breach of privacy that would've affected all YouTube accounts, many YouTubers like controversial content creators, investigators, whistleblowers, and activists keep their identities anonymous to protect their safety. Exposing such users' emails could have had huge ramifications.
Brutecat discovered that blocking a user on YouTube revealed a unique internal identifier Google uses for each user across all of its platforms (Gmail, Google Drive, etc.) called a Gaia ID. They then figured out that simply clicking the three dot icon of a user's live chat profile to access the block function triggered an API request that revealed their Gaia ID.
This in itself is already a security flaw since it exposed the unique identifiers for YouTube accounts that is only meant to be used internally. But now that Brutecat was able to retrieve users' Gaia IDs, they set out to see if they could reveal the email addresses associated with each ID.
With Nathan's help, the two researchers surmised they could do this with "old forgotten Google products since they probably contained some bug or logic flaw to resolve a Gaia ID to an email." Using Google's Recorder app for Pixel devices, they tested sharing a recording with an obfuscated Gaia ID and blocked the user from receiving an email notification by renaming the file with a 2.5 million letter name, which broke the email notification system because it was too long.
Now that the hypothetical victim wouldn't be notified, the researchers sent the file sharing request with the Gaia IDs, effectively converting the ID into an email address.
Thanks to Brutecat and Nathan's sleuthing, Google was able to lock down that vulnerability and prevent hackers from accessing everyone's email address associated with their YouTube accounts. The vulnerability was disclosed to Google in Sep. 2024 and was finally fixed on Feb. 9, 2025. That's a long time for potential exposure, but Google confirmed to BleepingComputer that there were "no signs that any attacker actively exploited the flaws."
In exchange for their work, the researchers received a cool $10,633. Phew, crisis averted.
Topics Cybersecurity YouTube
'Blind' robot dog can hunt you even on a moonless nightThe best album covers of 2018 (so far)When birthday parties become holy birthday monthsFacebook patents 'skin smoothing' and karaoke features for live videoHarriet the eagle, famous for visiting veterans, dies at 35Garbage plates: The great American dishEngland fans storm London IKEA after World Cup win over SwedenBelkin's MFiSouthern Lights come to life in video from International Space StationChris Evans should play a villain in his next movieAll the best apps of 2018. (So far.)Southern Lights come to life in video from International Space Station'The One I Love' is the movie to watch after 'The Handmaid's Tale'Facebook patents 'skin smoothing' and karaoke features for live videoElon Musk building 'kidThe ultimate MashReads guide to summer readingElon Musk building 'kidSuperbug resistant to lastMan eats 74 hot dogs in 10 minutes, breaking his own world recordReports indicate Jawbone is selling speaker business [Updated] 'Game of Thrones' Season 8 will have multiple 80 SNL's Pete Davidson says Kid Cudi saved his life Report: Windows 10 update installs can be delayed for 35 days YouTube star Lilly Singh gets her own late Apple Music Launches on Amazon Fire TV Chris Hemsworth made the most wholesome content with a quokka Eliminating toxic masculinity should be on every parent's to Verizon's 5G network launches in Chicago and Minneapolis on April 14 Apple says Spotify wants to 'make more money off others' work' Reddit bans violent subreddits following Christchurch terrorist attack Global climate strike begins, with students skipping school to protest The 'Pringles ringle' is a stunning feat of snack engineering Zayn is very inspired and a little weirded out by your fan fiction Photos of magical night buses could be proof of a parallel wizarding universe Inside Tesla's Model Y unveiling event with Elon Musk Facebook's News Feed changes were supposed to make us feel good. It's not working. Amazon's 'Four More Shots Please' is engrossing despite its faults Flight on Southwest or American? Make sure it wasn't on a Boeing 737 Max. It's not your imagination: This Facebook outage is massive Google's Lookout app helps the blind explore their surroundings
2.9342s , 8285.6796875 kb
Copyright © 2025 Powered by 【famous books about eroticism】,Exquisite Information Network